Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit40bc4c2

Browse files
committed
Disable the use of Unicode escapes in string constants (U&'') when
standard_conforming_strings is not on, for security reasons.
1 parent616bceb commit40bc4c2

File tree

4 files changed

+76
-2
lines changed

4 files changed

+76
-2
lines changed

‎doc/src/sgml/syntax.sgml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.131 2009/04/27 16:27:36 momjian Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.132 2009/05/05 18:32:17 petere Exp $ -->
22

33
<chapter id="sql-syntax">
44
<title>SQL Syntax</title>
@@ -499,6 +499,17 @@ U&amp;'d!0061t!+000061' UESCAPE '!'
499499
specified.
500500
</para>
501501

502+
<para>
503+
Also, the Unicode escape syntax for string constants only works
504+
when the configuration
505+
parameter <xref linkend="guc-standard-conforming-strings"> is
506+
turned on. This is because otherwise this syntax could confuse
507+
clients that parse the SQL statements to the point that it could
508+
lead to SQL injections and similar security issues. If the
509+
parameter is set to off, this syntax will be rejected with an
510+
error message.
511+
</para>
512+
502513
<para>
503514
To include the escape character in the string literally, write it
504515
twice.

‎src/backend/parser/scan.l

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
* Portions Copyright (c) 1994, Regents of the University of California
2525
*
2626
* IDENTIFICATION
27-
* $PostgreSQL: pgsql/src/backend/parser/scan.l,v 1.151 2009/04/19 21:08:54 tgl Exp $
27+
* $PostgreSQL: pgsql/src/backend/parser/scan.l,v 1.152 2009/05/05 18:32:17 petere Exp $
2828
*
2929
*-------------------------------------------------------------------------
3030
*/
@@ -469,6 +469,11 @@ other.
469469
startlit();
470470
}
471471
{xusstart}{
472+
if (!standard_conforming_strings)
473+
ereport(ERROR,
474+
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
475+
errmsg("unsafe use of string constant with Unicode escapes"),
476+
errdetail("String constants with Unicode escapes cannot be used when standard_conforming_strings is off.")));
472477
SET_YYLLOC();
473478
BEGIN(xus);
474479
startlit();

‎src/test/regress/expected/strings.out

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ ERROR: syntax error at or near "' - third line'"
2222
LINE 3: ' - third line'
2323
^
2424
-- Unicode escapes
25+
SET standard_conforming_strings TO on;
2526
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
2627
data
2728
------
@@ -34,6 +35,18 @@ SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
3435
dat\+000061
3536
(1 row)
3637

38+
SELECT U&' \' UESCAPE '!' AS "tricky";
39+
tricky
40+
--------
41+
\
42+
(1 row)
43+
44+
SELECT 'tricky' AS U&"\" UESCAPE '!';
45+
\
46+
--------
47+
tricky
48+
(1 row)
49+
3750
SELECT U&'wrong: \061';
3851
ERROR: invalid Unicode escape value at or near "\061'"
3952
LINE 1: SELECT U&'wrong: \061';
@@ -46,6 +59,32 @@ SELECT U&'wrong: +0061' UESCAPE '+';
4659
ERROR: invalid Unicode escape character at or near "+'"
4760
LINE 1: SELECT U&'wrong: +0061' UESCAPE '+';
4861
^
62+
SET standard_conforming_strings TO off;
63+
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
64+
ERROR: unsafe use of string constant with Unicode escapes
65+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
66+
SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
67+
ERROR: unsafe use of string constant with Unicode escapes
68+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
69+
SELECT U&' \' UESCAPE '!' AS "tricky";
70+
ERROR: unsafe use of string constant with Unicode escapes
71+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
72+
SELECT 'tricky' AS U&"\" UESCAPE '!';
73+
\
74+
--------
75+
tricky
76+
(1 row)
77+
78+
SELECT U&'wrong: \061';
79+
ERROR: unsafe use of string constant with Unicode escapes
80+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
81+
SELECT U&'wrong: \+0061';
82+
ERROR: unsafe use of string constant with Unicode escapes
83+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
84+
SELECT U&'wrong: +0061' UESCAPE '+';
85+
ERROR: unsafe use of string constant with Unicode escapes
86+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
87+
RESET standard_conforming_strings;
4988
--
5089
-- test conversions between various string types
5190
-- E021-10 implicit casting among the character data types

‎src/test/regress/sql/strings.sql

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,32 @@ SELECT 'first line'
1717
AS"Illegal comment within continuation";
1818

1919
-- Unicode escapes
20+
SET standard_conforming_strings TOon;
21+
22+
SELECT U&'d\0061t\+000061'AS U&"d\0061t\+000061";
23+
SELECT U&'d!0061t\+000061' UESCAPE'!'AS U&"d*0061t\+000061" UESCAPE'*';
24+
25+
SELECT U&'\' UESCAPE'!' AS "tricky";
26+
SELECT'tricky' AS U&"\" UESCAPE'!';
27+
28+
SELECT U&'wrong: \061';
29+
SELECT U&'wrong: \+0061';
30+
SELECT U&'wrong:+0061' UESCAPE'+';
31+
32+
SET standard_conforming_strings TO off;
33+
2034
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
2135
SELECT U&'d!0061t\+000061' UESCAPE'!' AS U&"d*0061t\+000061" UESCAPE'*';
2236
37+
SELECT U&' \' UESCAPE'!' AS "tricky";
38+
SELECT'tricky' AS U&"\" UESCAPE'!';
39+
2340
SELECT U&'wrong: \061';
2441
SELECT U&'wrong: \+0061';
2542
SELECT U&'wrong:+0061' UESCAPE'+';
2643
44+
RESET standard_conforming_strings;
45+
2746
--
2847
-- test conversions between various string types
2948
-- E021-10 implicit casting among the character data types

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp